If this is your first visit, be sure to
check out the FAQ by clicking the
link above. You may have to register
before you can post: click the register link above to proceed. To start viewing messages,
select the forum that you want to visit from the selection below.

The /u switch signals an "unconditional" format which means that no unformat information is stored, all files are erased and all filespace is overwritten with zeroes (actually hex F6h). This ensures that commands like unformat or undelete and utilities such as Norton Unerase will not be able to recover the
data.

NTFS stores a backup copy of the boot sector at the end of the partition and a copy of the MFT (Master File Table) somewhere in the middle. If you can recover those you can restore the filesystem. However I suspect Reiser will overwrite some data at the beginning of the partion (128k maybe?) to store its own data and superblock.As Sir Dice mentioned the data is not explicitly overwritten that I am aware of and I concur that Vista is most likely no different,

I remember using "debug" to jump to the ROM on the MFM controller to do a low-level format. Those were the days......

-Maestr0

Last edited by Maestr0; June 30th, 2007 at 03:19 AM.

\"If computers are to become smart enough to design their own successors, initiating a process that will lead to God-like omniscience after a number of ever swifter passages from one generation of computers to the next, someone is going to have to write the software that gets the process going, and humans have given absolutely no evidence of being able to write such software.\" -Jaron Lanier

Ummm... well, yes, NTFS does so but then, what about the FAT? I do not see any BACKUP copy in case of FAT/FAT32? How does one recover data from that one?

Once again, I do not agree that NTFS keeps a backup copy for the MFT. I am open to change; however, here are some lines from the book Inside Microsoft Windows 2000:

The MFT's own file record is the first entry in the table; the second file record points to a file located in the middle of the disk called the MFT mirror (filename $MftMirr) that contains a copy of the first few rows of the MFT. This partial copy of the MFT is used to locate metadata files if part of the MFT file can't be read for some reason.

This one contradicts the statement ... as a backup copy is something which an "entire" copy of the main / original thing. So if we happen to read the $MftMirr file, we can only read some records, not all of them. Since, even a High-level format will recreate the MFT as a series of BLANK records, the file location info is lost.

I think that the recovery in this case is done by reading the files on the disk, not the LOST MFT records.

Please remember that a "copy" as in "backup" is not neccessarily an exact mirror image. There is sufficient data to perform a recovery providing the metadata are not corrupted. Think of it as a sort of copy of the indexing files.

Certainly in the past a lot of "backup" systems stored files in a compressed form with a key or master file to allow recreation of the original data. The same concept as data compression.

F6h or 00h? The question is irrelevant, as the objective is simply to produce a "clean" installation environment. There is no secure erasure requirement, which would require a more complex, multiple overwriting pattern. An incidental feature is that this process tests the writability of sectors/clusters as well as their readability.

Since, even a High-level format will recreate the MFT as a series of BLANK records, the file location info is lost.

It doesn't alter the recovery data.

I think that the recovery in this case is done by reading the files on the disk, not the LOST MFT records.

It isn't.................. you only have to use recovery software to see that. Programs that recover files from their raw fragments take hours to run. The others (more common) take minutes.

You have cleared the scene a lot. Actually all my doubt was dependent on the word backup. When Maestr0 said that a "BACKUP COPY" is stored, I took it as a "Complete" backup copy. And all my question about the NTFS MFT and $MftMirr was based on that 'backup' word. Anyway thanks a lot.

It doesn't alter the recovery data.

Well, I already know that. Now as you told that

It isn't.................. you only have to use recovery software to see that. Programs that recover files from their raw fragments take hours to run. The others (more common) take minutes.

Does that mean that even after a format, some software can read the previous MFT records and recover the files?

Thanks for the FAT32 link too; it however did not contain anything in DETAIL, but was a nice read.